To identify errors, security breaches, or other anomalous behavior in computing systems, system administrators may implement automated checks. Such automated checks may be performed by processes that periodically execute to analyze performance data or other types of data captured during the operation of the computing system being checked. In many cases, the processes to implement automated checks may not be adequate to identify anomalous behavior in computing systems, particularly when the anomalous behavior is subtle or is indicated by patterns or correlations in the data.